chore(deps): update CLI to v3.6.1

[github-actions]

Bumps sentry-cli.properties from 3.3.0 to 3.6.1.

Auto-generated by a dependency updater.

Changelog

3.6.1

Fixes

• (sourcemaps) Prevent Debug ID collisions between distinct JS files that share identical sourcemaps by hashing both the JS and sourcemap bytes when injecting Debug IDs (#3356)

3.6.0

Features

• (snapshots) Compress preprod snapshot manifest with zstd (#3336)

Fixes

• (snapshots) Update snapshots download to use the new archive endpoint, triggering the archive build and polling until it is ready before downloading (#3344)
• (snapshots) Show a clear "project was renamed" error instead of a cryptic JSON parse failure when uploading to a renamed project slug (#3341)
• Fix update nagger never showing when a newer version is available (#3347)

3.5.1

Internal Changes 🔧

Deps

• Bump objectstore-client to 0.1.12 by NicoHinderling in #3334
• Bump shell-quote from 1.8.3 to 1.8.4 by dependabot in #3327
• Bump docker/login-action from 4.1.0 to 4.2.0 by dependabot in #3323
• Bump actions/github-script from 8.0.0 to 9.0.0 by dependabot in #3325
• Bump getsentry/craft from 2.26.3 to 2.26.6 by dependabot in #3322
• Bump docker/build-push-action from 7.1.0 to 7.2.0 by dependabot in #3324

Other

• (npm) 🤖 Bump optional dependencies to 3.5.0 by sentry-release-bot[bot] in 8c2c0e9a
• Remove experimental flag from snapshots and build commands by NicoHinderling in #3329

3.5.0

Features

• (snapshots) Add snapshots diff command for locally comparing directories of PNG snapshot images using odiff (#3306)
• (snapshots) Add snapshots download command for downloading baseline snapshot images from Sentry (#3310)
• (snapshots) Add --all-image-file-names and --all-image-file-names-file flags to snapshots upload for detecting image removals and renames in selective builds (#3312)
• Add PE DWARF companion support (#3240)
• Add Windows ARM64 PE unwind support (#3240)

Fixes

• Improve error message when organization slug is missing from config (#3311)
• Respect CURL_CA_BUNDLE and SSL_CERT_FILE when configuring TLS certificate authorities (#3301).

Internal changes

• Bump symbolic to 13.1.1 (#3240)

3.4.3

Security Fixes

• Behavior-breaking: Disable Xcode Info.plist preprocessing by default to avoid passing project-controlled compiler settings to cc during release auto-discovery. This affects sentry-cli releases propose-version, sentry-cli send-event and sentry-cli bash-hook --send-event release inference, and sentry-cli react-native xcode auto-release detection. Use --allow-xcode-infoplist-preprocessing only for trusted projects that require preprocessing.
• Ensure restrictive file permissions maintained when sentry-cli login updates existing config files.
• Disable TLS verification only when http.verify_ssl is set to false, case-insensitively.
• Shell-escape generated bash-hook arguments, including paths, tags, release names, and the CLI path.
• Stop sending environment variables in sentry-cli bash-hook events.
• Verify the downloaded binary checksum before replacing the current executable in sentry-cli update.

Performance

• (snapshots) Skip uploading images that already exist in objectstore by batch-checking with HEAD requests first (#3305)

Fixes

• (snapshots) Reject snapshot uploads that have a PR number but no base SHA, since comparisons cannot work without a base reference (#3300)

3.4.2

Fixes

• (snapshots) Stop sending Sentry auth token to Objectstore (#3286)
• (js) Fix argument injection in JavaScript API's serializeOptions. String/number options now validate input types and prevent Array.prototype.concat() from flattening array values into separate CLI arguments. (#3287)

3.4.1

Improvements

• (bundle-jvm) Warn and skip subsequent duplicates when multiple files strip to the same URL (e.g. Android build variants contributing the same FQCN). The warning points users at --exclude to scope the bundle to a single variant (#3275).

Fixes

• (bundle-jvm) Strip the [<module>/]src/<sourceset>/<lang>/ prefix from bundle URLs so Symbolicator can resolve them from package-based stack traces (e.g. sentry-android-core/src/main/java/io/sentry/android/core/ANRWatchDog.java → ~/io/sentry/android/core/ANRWatchDog.jvm) (#3275).

3.4.0

Features

• (snapshots) Add --selective flag to build snapshots to indicate the upload contains only a subset of images (#3268)
• (bundle-jvm) Allow running directly on a project root (including multi-module repos) by automatically collecting only JVM source files (.java, .kt, .scala, .groovy), respecting .gitignore, and excluding common build output directories (#3260)
• (bundle-jvm) Add --exclude option for custom glob patterns to exclude files/directories from source collection (#3260)

Performance

• (snapshots) Parallelize image hashing with rayon (#3250)

Fixes

• (snapshots) Chunk image uploads to avoid file descriptor exhaustion and 413 errors when uploading hundreds of images (#3249)
• (snapshots) Preserve subdirectory structure in snapshot manifest keys instead of flattening to bare filenames (#3269)
• Replace eprintln! with log::info! for progress bar completion messages when the progress bar is disabled (e.g. in CI). This avoids spurious stderr output that some CI systems treat as errors (#3223).

3.3.5

Performance

• (snapshots) Parallelize image hashing with rayon (#3250)

Fixes

• (sourcemaps) Skip non-base64 embedded sourcemaps during injection (#3243)

3.3.4

New Features ✨

• (snapshots) Add --diff-threshold option to build snapshots to set a minimum pixel difference percentage for reporting image changes (#3259)
• Add sentry-cli build download command to download installable builds (IPA/APK) by build ID (#3221).
• Add sentry-cli code-mappings upload command to bulk upload code mappings from a JSON file (#3207, #3208, #3209, #3210).
  • Code mappings link stack trace paths (e.g. com/example/module) to source paths in your repository (e.g. src/main/java/com/example/module), enabling Sentry to display source context and link directly to your code from error stack traces.
  • Repository name and default branch are automatically inferred from your local git remotes, or can be specified explicitly with --repo and --default-branch.
  • Large mapping files are automatically split into batches for upload.

3.3.3

Internal Changes 🔧

• (npm) 🤖 Bump optional dependencies to 3.3.2 in afdef906

3.3.2

New Features ✨

• (preprod) Add VCS parameters to snapshots upload command by rbro112 in #3200

Internal Changes 🔧

• (npm) 🤖 Bump optional dependencies to 3.3.1 in 3200dfb9

3.3.1

Fixes

• Accept ProGuard mapping files without line information instead of rejecting them (#3192).
• Improve error message when uploading .xcarchive or .ipa files on non-Apple Silicon Macs (#3211).

Experimental Feature 🧑‍🔬 (internal-only)

• Pipe snapshot sidecar metadata into upload as part of sentry-cli build snapshots command (#3163).

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 75c5b8e. Configure here.}

[cursor]

Bump targets nonexistent CLI release

High Severity

sentry-cli.properties sets version to 3.6.1, but no stable GitHub release with that tag exists—only 3.6.1-snapshot.* prereleases, while the latest stable is 3.6.0. download-sentry-cli.sh will request /releases/download/3.6.1/..., which 404s. Without curl --fail, that can package non-binary error bodies and break uploadSourceBundle at runtime.

Additional Locations (1)

• CHANGELOG.md#L10-L13

 

^{Reviewed by Cursor Bugbot for commit 75c5b8e. Configure here.}